CVE-2025-9834

Опубликовано: 02 сент. 2025

Источник: nvd

CVSS3: 3.5

CVSS3: 5.4

CVSS2: 4

EPSS Низкий

Описание

A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Executing manipulation of the argument Username can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

Ссылки

https://github.com/YoSheep/cve/blob/main/PHPGurukul%20Small%20CRM%20in%20PHP%20V4.0%20Multiple%20Stored%20Cross-Site%20Scripting%20(XSS)%20Vulnerabilities.md
Exploit
Third Party Advisory
https://phpgurukul.com/
Product
https://vuldb.com/?ctiid.322181
Permissions Required
VDB Entry
https://vuldb.com/?id.322181
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.642025
Third Party Advisory
VDB Entry
https://github.com/YoSheep/cve/blob/main/PHPGurukul%20Small%20CRM%20in%20PHP%20V4.0%20Multiple%20Stored%20Cross-Site%20Scripting%20(XSS)%20Vulnerabilities.md
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpgurukul:small_crm:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 8%

0.00032

Низкий

3.5 Low

CVSS3

5.4 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-hm77-xmfq-6722

CVSS3: 3.5

github

около 1 месяца назад

EPSS

Процентиль: 8%

0.00032

Низкий

3.5 Low

CVSS3

5.4 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-79